Yes. At the moment, this is done by accessing SharePoint 2013 changes database directly, so after a full scan the connector will only fetch objects that changes in a given date range (since the last scan and the current scan).
SharePoint 2013 doesn't keep track of item updates/deletes for BCS external list items on it's change log. To be able to check for changes on BCS external lists, all external list items are crawled and checked against the information on the current snapshot file. If any of those items has any changes, then it is sent to the pipeline to be updated or deleted.
For a discussion on crawling, see here.
Those permissions ("Full Read") are required so the connector can fetch additional information from site collections. This information is required for incremental indexing.
If setting permissions at Web Application level is not suitable to your environment, consider setting site collection administrator rights to the crawler account on each site collection you want to crawl. (This will work without Web App permissions, but has to be set on every site collection.)